azure-disk-sas-export-conditional
beginGetAccess/action on a disk with AllowPrivate network access policy mints a SAS download URL accessible only via the private endpoint.
match (effective permission)
{
"action": "Microsoft.Compute/disks/beginGetAccess/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
disk.networkAccessPolicy == AllowPrivate
emit
| source type | Identity |
|---|---|
| target type | BlockStorage |
| source | <principal> |
| target | <managed disk> |
| permissions | Microsoft.Compute/disks/beginGetAccess/action |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): SAS URL is scoped to the associated DiskAccess private endpoint; attacker needs a foothold in the target VNet to fetch the URL. |
Narrative
{principal.name} can call beginGetAccess/action on disk {target.name} (AllowPrivate network policy) to mint a SAS download URL resolvable only via the private endpoint; exfiltration requires network connectivity to the private endpoint's VNet.
Raw rule rules/derived/azure/disks.yaml
id: azure-disk-sas-export-conditional
emits: CanExfiltrate
description: beginGetAccess/action on a disk with AllowPrivate network access policy mints a SAS download
URL accessible only via the private endpoint.
match_effective_permission:
action: Microsoft.Compute/disks/beginGetAccess/action
scope_type: resource|resourceGroup|subscription
where:
- disk.networkAccessPolicy == AllowPrivate
emit:
source_type: Identity
target_type: BlockStorage
source: <principal>
target: <managed disk>
permissions:
- Microsoft.Compute/disks/beginGetAccess/action
conditions:
- network_reachability
state_logic: 'CONDITIONAL(network_reachability): SAS URL is scoped to the associated DiskAccess private
endpoint; attacker needs a foothold in the target VNet to fetch the URL.'
confidence: 0.95
derived_from:
- HasPermission(principal, Microsoft.Compute/disks/beginGetAccess/action, disk)
false_positive_note: 'networkAccessPolicy: AllowPrivate restricts the SAS URL to a private endpoint
VNet. Emit CONDITIONAL(network_reachability) unless attacker foothold in VNet is confirmed. The permission
scope must cover the specific disk resource (honor RG/sub inheritance but also honor deny assignments
scoped to the disk''s RG or the disk).'
narrative: '{principal.name} can call beginGetAccess/action on disk {target.name} (AllowPrivate network
policy) to mint a SAS download URL resolvable only via the private endpoint; exfiltration requires
network connectivity to the private endpoint''s VNet.'